IE7 KB931768 update missing corpol.dll

http://www.microsoft.com/technet/sec.../ms07-027.mspx

I am comparing the files installed by KB931768 on Win XP SP2 and what is
listed on the page listed above and a number of files mismatch (they actually
have a newer version in the patch), but one file, corpol.dll, listed as
included in the patch wasn't actually in it.

Is the file manifest wrong or was this accidentally left out?


Also the KB933668 patch for the Office 2007 Compatibility Pack lists that it
installs Xl12cnv.exe. I could not find that file, but I did find
excelcnv.exe which contains the same exact size, date, time and version
number. I also found an updated Wordconv.exe and Wordconv.dll not listed on
the web page below:

http://www.microsoft.com/technet/sec.../ms07-023.mspx

"Michael Kraft" <> schrieb:

> http://www.microsoft.com/technet/sec.../ms07-027.mspx
>
> I am comparing the files installed by KB931768 on Win XP SP2 and what is
> listed on the page listed above and a number of files mismatch (they actually
> have a newer version in the patch), but one file, corpol.dll, listed as
> included in the patch wasn't actually in it.
>
> Is the file manifest wrong or was this accidentally left out?

corpol.dll isn't included in KB931768 for whatever reason.
Also, the more or less essential DLLs browseui.dll, shdocvw.dll
and shlwapi.dll aren't updated in IE7 "Cumulative" Updates either,
although IE7 uses of them. To get the actual ones, which may or
may not issues also effecting IE7 users in Windows XP SP2, you
have to uninstall IE7, apply the actual Cumulative Update for IE6
"SP2" included in SP2 for Windows XP afterwards, reinstall IE7
and (re)apply the Cumulative Update for IE7 finally.

Bad, no, braindead behaviour, if someone would ask me,
Freudi

"Ottmar Freudenberger" wrote:

> corpol.dll isn't included in KB931768 for whatever reason.
> Also, the more or less essential DLLs browseui.dll, shdocvw.dll
> and shlwapi.dll aren't updated in IE7 "Cumulative" Updates either,
> although IE7 uses of them. To get the actual ones, which may or
> may not issues also effecting IE7 users in Windows XP SP2, you
> have to uninstall IE7, apply the actual Cumulative Update for IE6
> "SP2" included in SP2 for Windows XP afterwards, reinstall IE7
> and (re)apply the Cumulative Update for IE7 finally.
>
> Bad, no, braindead behaviour, if someone would ask me,
> Freudi
>

Well it lists corpol.dll as being in the update, that's what flagged it for
me. The issue with the system dlls not being updated in IE7, which I didn't
even think about, is pretty stupid. That makes no sense.

"Michael Kraft" <> schrieb:
> "Ottmar Freudenberger" wrote:
>
>> corpol.dll isn't included in KB931768 for whatever reason.
>> Also, the more or less essential DLLs browseui.dll, shdocvw.dll
>> and shlwapi.dll aren't updated in IE7 "Cumulative" Updates either,
>> although IE7 uses of them. To get the actual ones, which may or
>> may not issues also effecting IE7 users in Windows XP SP2, you
>> have to uninstall IE7, apply the actual Cumulative Update for IE6
>> "SP2" included in SP2 for Windows XP afterwards, reinstall IE7
>> and (re)apply the Cumulative Update for IE7 finally.
>>
>> Bad, no, braindead behaviour, if someone would ask me,
>> Freudi
>>
>
> Well it lists corpol.dll as being in the update, that's what flagged it for
> me.

Anyhow, it's *not* included actually. Maybe calling PSS or at least
commenting on the IE blog will inlight us (which I doubt, but "hope"
is one of the basics dealing with MS software issues of any kind
anyway):
http://blogs.msdn.com/ie/archive/200...lable-now.aspx

> The issue with the system dlls not being updated in IE7, which I didn't
> even think about, is pretty stupid. That makes no sense.

ACK,
Freudi

"Michael Kraft" wrote:

>
>
> "Ottmar Freudenberger" wrote:
>
> > corpol.dll isn't included in KB931768 for whatever reason.
> > Also, the more or less essential DLLs browseui.dll, shdocvw.dll
> > and shlwapi.dll aren't updated in IE7 "Cumulative" Updates either,
> > although IE7 uses of them. To get the actual ones, which may or
> > may not issues also effecting IE7 users in Windows XP SP2, you
> > have to uninstall IE7, apply the actual Cumulative Update for IE6
> > "SP2" included in SP2 for Windows XP afterwards, reinstall IE7
> > and (re)apply the Cumulative Update for IE7 finally.
> >
> > Bad, no, braindead behaviour, if someone would ask me,
> > Freudi
> >
>
> Well it lists corpol.dll as being in the update, that's what flagged it for
> me. The issue with the system dlls not being updated in IE7, which I didn't
> even think about, is pretty stupid. That makes no sense.

Well I found web pages that state that browseui.dll and shdocvw.dll are no
longer used in ie7 as they were replaced by ieframe.dll.

Though explorer still uses browseui.dll and shdocvw.dll so one would think
that if there are flaws in them that would mean explorer would still be
vulnerable. Though typing in a URL in explorer open IE7 (or the default
browser) so I'm not sure.

I noticed they removed the corpol.dll file from the older cumulative
security update (928090). Not sure if that was on purpose or not either.

"Michael Kraft" <> schrieb:

> Well I found web pages that state that browseui.dll and shdocvw.dll are no
> longer used in ie7 as they were replaced by ieframe.dll.

Well, convince yourself (assuming you're capable of reading
and understanding German <g>):
http://groups.google.de/groups?threadm=e2e04$461e7100$50db91ba$ ispeed.ch

> Though explorer still uses browseui.dll and shdocvw.dll so one would think
> that if there are flaws in them that would mean explorer would still be
> vulnerable. Though typing in a URL in explorer open IE7 (or the default
> browser) so I'm not sure.

Well, see above. It's IMHO foolish behaviuor by MS to ignore those facts!

> I noticed they removed the corpol.dll file from the older cumulative
> security update (928090). Not sure if that was on purpose or not either.

Hm, "Microsoft COM Runtime Execution Engine" - don't know either.

Bye,
Freudi